#http-only

cookie http-only csrf xsrf-token same-site web-security nextjs middleware open-graph rewrite seo sso slo authentication idp frontend bff react resize-observer css-variables performance rendering typescript variance type-safety strict-function-types covariance image-optimization browser-image-compression jszip web-worker frontend-performance postmessage react-hook-form browser-api next-js healthkit ios swift workout apple-watch watchos react-19 useeffect render anti-pattern monorepo pnpm turborepo semver workspace package-management python venv virtual-environment troubleshooting gps pedometer live-activity react-native auto-pause claude-code remote-control mobile-development web-session productivity rtk token-optimization figma-api developer-tools cdn infrastructure mermaid mdx diagram aws-s3 presigned-url file-upload hmac security agentic-loop token-flow hooks prompt-caching shell-script automation figma cli skill agent responsive-publishing context-window subagent team multi-agent ai-collaboration publishing claude-md memory ai-workflow history-api form xcode eas expo widget swiftui app-group sandbox html accessibility a11y nice-auth post-vs-get callback in-app-browser ssg static-site-generation getstaticprops getstaticpaths css contain browser javascript animation lerp linear-interpolation requestanimationframe code-splitting react-lazy dynamic-import preloading reflow repaint composite-layer transform will-change browser-rendering image-upload mobile-web docusaurus mintlify documentation openapi static-site-generator 3d-transform perspective transform-style search-console sitemap metadata canonical jsx transpile ast virtual-dom dom reconciliation synthetic-event flux declarative immutability frontend-history mvc mvvm jquery backbone swiper oauth user-agent-detection post-message session-storage ssr isr cache-control vercel aws route53 dns domain txt-record intersection-observer infinite-scroll chat-ui scroll-behavior vpc ec2 iam cloud-basics performance-now dom-high-res-timestamp monotonic-clock user-timing-api node-perf-hooks jenkins ci-cd github-webhook kubernetes docker cicd continuous-integration continuous-delivery continuous-deployment devops data-structure map set git github fork clone version-control oss-contribution generics type-system keyof interface git-branch remote prune closure lexical-scope execution-context deep-dive lexical-environment hoisting scope this binding cssom render-tree tcp first-class-object function arguments var let const type-alias redux redux-toolkit state-management mouse-event drag

2026년 7월 16일Article

HttpOnly 쿠키와 XSRF-TOKEN, 세션 식별 트러블슈팅

다른 기기 로그인 시 세션 종료 모달이 조용히 안 뜨던 버그를 쫓다가, HttpOnly 세션 쿠키를 document.cookie로 읽으려던 게 원인임을 실측으로 확인했다.

READ MOREREAD MORE→